SHF: Small: Architectural Support for Securing Deep Neural Networks

基于深度神经网络的机器学习算法在垃圾邮件检测、流量分析、入侵检测、医疗预测、金融预测等多个领域取得了显著的成果。神经网络（NN）驱动的技术，如图像/语音识别和个人辅助应用程序，极大地提高了生活质量，已成为人们日常依赖的公用事业。基于神经网络的机器学习算法通常托管在云服务器上，作为提供给用户的服务，这涉及到它们的安全性，即如何保护用户的私人数据免受黑客以及可信但好奇的服务器的攻击；如何保护模型盗版和加强知识产权保护。采用传统的基于加密的防御往往会给系统带来严重的性能下降。该项目解决了这些问题，从而有助于在计算云和移动客户端中增加机器学习加速器架构的使用。确保用户的IP得到安全保护。这项工作将研究与高等教育结合起来，包括本科和研究生阶段的课程创新，以及向代表性不足的群体和K-12教育的推广。该项目为用户从云获取服务开发了一个安全、隐私保护、保密和防篡改的环境。它侧重于三个任务。1)通过用户依赖的建模来保护IP：开发轻量级训练和推理方法，以产生只能对合法IP所有者执行的模型。这种依赖可以来自目标硬件或IP所有者之间共享的秘密。2)数据隐私保护：为保护隐私的加密同态加密（HE）开发了加速技术，该技术在加密数据上运行神经网络，但可能会使推理速度降低几个数量级。对HE进行了分析，选择了最合适的加速器，并进行了HE在加速器上的优化映射，使其性能最大化。3)保护神经网络的机密性和完整性，防御侧信道攻击：通过增加内存加密、认证、总线保护和隔离，保护神经网络的动态执行，防御针对加速器硬件的复杂攻击。本项目中提出的设计利用了神经网络的独特性，并实现了对性能的最小影响。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Machine learning algorithms based on deep neural networks have achieved remarkable results in a variety of domains such as spam detection, traffic analysis, intrusion detection, medical predictions, and financial predictions. Neural network (NN) driven technologies such as image/voice recognition and personal assistance apps have greatly improved the quality of life and have become utilities people rely on everyday. NN-based machine learning algorithms are often hosted on cloud servers as a service provided to users, which concerns their security, that is, how to protect user private data from hackers as well as trusted-yet-curious servers; how to protect model piracy and enforce intellectual property (IP) protection. Adopting traditional encryption based defenses tends to introduce severe performance degradation to the system. This project addresses these issues and thus help increase the use of accelerator architectures for machine learning in the computing cloud and mobile clients. It assures the IP of users are securely protected. The work integrates research with high education with curricular innovation at both the undergraduate and graduate levels and with outreach to under-represented groups and K-12 education. This project develops a secure, privacy-preserving and confidential and tamper-proofing environment for users to acquire services from the cloud. It focuses on three tasks. 1) IP protection via user dependent modeling: lightweight training and inference methodologies are developed to produce models that can only execute on legitimate IP owners. Such dependency can be derived from either target hardware or a secret shared among IP owners. 2) Data privacy protection: acceleration techniques are developed for a privacy-preserving cryptographic homomorphic encryption (HE) which runs NN on encrypted data but could slow down an inference by several orders of magnitude. HE is analyzed, the most suitable accelerator is selected and optimized mapping of HE onto the accelerator is developed to maximize its performance. 3) Protection for confidentiality and integrity of NN, and defend side-channel attacks: protect dynamic execution of NNs by adding memory encryption, authentication, bus protection and isolation to defend sophisticated attacks targeted at the accelerator hardware. The proposed designs in this project exploit uniqueness of NN and achieve minimum impact on performance.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.